UBUNTU-CVE-2026-98506

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

UBUNTU-CVE-2026-98509

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

UBUNTU-CVE-2026-98521

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...

UBUNTU-CVE-2026-98523

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

UBUNTU-CVE-2026-98539

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

UBUNTU-CVE-2026-98545

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

UBUNTU-CVE-2026-98546

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

UBUNTU-CVE-2026-98553

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

UBUNTU-CVE-2026-98445

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

UBUNTU-CVE-2026-98446

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

UBUNTU-CVE-2026-98448

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

UBUNTU-CVE-2026-98449

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...

UBUNTU-CVE-2026-98450

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

UBUNTU-CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

UBUNTU-CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

UBUNTU-CVE-2026-98550

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

UBUNTU-CVE-2026-98558

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

UBUNTU-CVE-2026-98497

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...

UBUNTU-CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

UBUNTU-CVE-2026-98468

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...